Jack Cable

New from Jen Easterly and me: as threats to our critical infrastructure increase, U.S. policymakers need to defend + strengthen the role of security research. This is personal for me, having received legal threats for good-faith security research.

We call on Congress to protect security researchers by codifying the DMCA security research exemption, exempt good-faith security research from the CFAA, and require software vendors to operate a VDP and publish CVEs.

https://www.lawfaremedia.org/article/advancing-secure-by-design-through-security-research

Today, I published in the Harvard Business Review on how business leaders of software manufacturers can prevent ransomware attacks at scale with more secure by design software.

The vast majority of ransomware attacks are enabled by a software design defect or insecure default configuration. It's up to software manufacturers to raise the tide and help secure everyone.

Read here: https://hbr.org/2024/04/preventing-ransomware-attacks-at-scale

I told Congress the story of how I got into hacking: winning the Hack the Air Force competition at 17, and helping start Stanford's bug bounty program as a freshman.

While we've made progress, we need to do more to normalize security research. I called on Congress to reform the Computer Fraud and Abuse Act by exempting good-faith security research.

After two incredible years, today is my last day at CISA. Immensely grateful to have been able to drive CISA's work on Secure by Design, spurring commitments from 250 software manufacturers and publishing guidance with over a dozen int'l partners.

My exit interview: https://cyberscoop.com/jack-cable-cisa-secure-by-design-exit-interview/

Extremely excited to launch CISA's Secure by Design Pledge today — where 68 of the world's leading software manufacturers are committing to demonstrating measurable progress around secure by design in seven specific areas over the next year. This is a major step forward in our efforts to increase adoption of secure by design principles.

Read our announcement: https://www.cisa.gov/news-events/news/cisa-announces-secure-design-commitments-leading-technology-providers

Have thoughts on Secure by Design? Yesterday, we announced a Request for Information on Secure by Design.

Have thoughts on eliminating classes of vulns, security education for developers, economics, AI, OT, and more? Check it out and respond (by Feb 20): https://www.federalregister.gov/documents/2023/12/20/2023-27948/request-for-information-on-shifting-the-balance-of-cybersecurity-risk-principles-and-approaches-for

Four years ago, as a computer science student at Stanford, I wrote what felt like a simple observation: I wasn’t required to take a security class, and neither were my peers.

It’s now 2024, and we’ve made little progress in educating developers. It is long overdue for academia to reconsider their role in producing a software developer workforce that writes defective software.

Read on: https://www.cisa.gov/news-events/news/we-must-consider-software-developers-key-part-cybersecurity-workforce

Memory safety vulnerabilities are the most common class of vulnerabilities, and have enabled some of the most damaging cyberattacks in recent years.

Fortunately, most memory safety vulnerabilities are preventable. CISA and our partners’ guidance on memory safe roadmaps gives companies a path forward to protect their customers by eliminating this class of vulnerabilities. We urge companies to develop and publish their memory safe roadmaps and lead by example.

Read more: https://go.dhs.gov/oyE

Excited to share new research w/ Ian Gray and Damon McCoy, where we leverage novel heuristics to identify over $700 million in previously-unreported ransomware payments. We publish our set of payments, which when combined with the Ransomwhere dataset totals over $900 million in ransomware payments — several times larger than any existing public dataset.

Read here: https://arxiv.org/abs/2408.15420
Get the data: https://github.com/cablej/showing-the-receipts

Great joining @RosenzweigP@mastodon.social on the Lawfare Podcast! Tune in for some holiday listening to hear from Lauren Zabierek, Bob Lord and me on CISA's path forward on Secure by Design.

https://www.lawfaremedia.org/article/the-lawfare-podcast-three-cisa-senior-advisers-on-secure-by-design